CVE-2026-62825 is a maximum severity (CVSS 10.0) improper authentication flaw in Azure Key Vault that lets an unauthorized attacker elevate privileges over a network. The record names no version. Read the Microsoft entry to see whether you must act, and review who can reach your vaults.
What's affected
- Product: Microsoft Azure Key Vault.
- Description in the record: improper authentication allows an unauthorized attacker to elevate privileges over a network.
- Fixed version: the record gives no version, since this is a cloud service. Microsoft's entry is the place to confirm whether you need to do anything.
- Weakness: CWE-287, improper authentication. CVSS 10.0, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H.
How to check if you're exposed
Cloud service flaws like this are normally remediated by the provider, and the record names no customer action. I could not load Microsoft's entry, so confirm there whether anything is required of you. Whatever the answer, these checks are worth running.
az keyvault list --query "[].name" -o tsv
az role assignment list --all --query "[?contains(scope,'vaults')].{who:principalName,role:roleDefinitionName}" -o table
What to do now
- Open the Microsoft Security Response Center entry and note any required customer action.
- List your Key Vaults and review who holds access through role assignments or access policies.
- Turn on diagnostic logging for each vault and send it to a log workspace you review.
- Look for unfamiliar callers or unusual secret reads, and rotate any secret you cannot account for.
- Use network rules or private endpoints to limit which networks can reach each vault.
Why it matters
Key Vault holds secrets, keys and certificates, so an authentication flaw there is high stakes. The vector shows network reach, no login, and a changed scope, which is why the score is at the top of the scale. Integrity and availability impacts are rated high.
The weakness is CWE-287, improper authentication. For a provider run service the fix is on the provider's side, which is why the record carries no version. Your part is limiting who can reach the vault and keeping logs. The KEV flag is false.
Quick check
Do I need to install a patch?
The record names no version, and a cloud service is normally fixed by the provider. Confirm in Microsoft's entry.
What is a sensible check in the meantime?
Review vault access, enable diagnostic logs and restrict network access to each vault.
Sources
- Microsoft Security Response Center entry (listed in the record, but it did not load when I reviewed it)
Last reviewed: 19 October 2026.
